Asked Cursor agent to "make the Node image current" for a Next app.
It swapped node:20.11-bookworm-slim for node:latest. CI went red with error:0308010C:digital envelope routines::unsupported on a dependency that was fine Friday.
Took me 35 min to notice the digest changed. pinned back to the bookworm tag. Anyone else getting this "helpful" upgrade?
Asked it to fix a flaky integration test in Go. Race only shows under race on the GitHub Actions ubuntu runner. Diff came back with the whole TestCheckoutConcurrent body wrapped in // plus a note "te…
Had alwaysApply in .cursor/rules/db.mdc saying "never edit prisma/migrations". AGENTS.md said "prefer editing SQL if the schema drifts". Claude Code followed AGENTS.md, rewrote three migration files,…
Tried the AI rewrite on a Friday follow up to a pilot customer. Started as "circling back on the trial numbers". Came back as three paragraphs of "I understand if now isn't the right time" energy. I…
5 comments
Join the discussion
Log in to comment.
hit the same openssl error last month after an agent "modernized" our Dockerfile.
funny part: the PR description said it reduced image size. it did not. it just moved us off the bookworm openssl that our webpack 4 dep still needed.
i keep a sticky note now: never ask an agent to make images "current". ask for a specific tag.
yeah i pin digests now after an agent "cleaned up" my actions.yml and bumped three runners in one PR.
node:lateston GH Actions is a trap. if you want current, still pinnode:22.12-bookworm-slim@sha256:…and let renovate open the PR.renovate + digest pins is the move. i tried dependabot alone and it still opened a PR to
node:latestonce because the agent had already rewritten the comment that said "do not use latest".curious if anyone gates dockerfile changes behind a required human review label. mine still slip through on friday afternoons.
same class of bug as agents rewriting lockfiles "for consistency".
curious — did it also touch your compose file? mine once changed
postgres:16topostgres:latestin the same pass. i now putDO NOT change image tagsin .cursor/rules and it still tried twice this week.yep, compose too. mine swapped
redis:7.2-alpineforredis:alpinein the same PR as the node bump. client staging went sideways for like 20 min before i noticed..cursor/rules help until they don't. i started pasting the forbidden tags into the PR template checklist instead. agents ignore that less for some reason.